Analysis

  • max time kernel
    4s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    24-05-2022 13:43

General

  • Target

    8a86db3b2d144844a959cf43dbe8ff4dc80b9ce0513e5bd7dd9fdf9325a4f2ac.exe

  • Size

    621KB

  • MD5

    d41a2901bf1d0f3ba6b9498d6542c437

  • SHA1

    cbbb9798a8bec4aa787cb4de24e07bcbe4a16983

  • SHA256

    8a86db3b2d144844a959cf43dbe8ff4dc80b9ce0513e5bd7dd9fdf9325a4f2ac

  • SHA512

    231d6a471c8d41d7fbcaf4278af36bfb8495a57327210ef71d9be98a80ba7ec312dc92c1a75448df63a5362917bf35814e4e32c10ef2f3b33536b408d6f7e504

Score
10/10

Malware Config

Extracted

Family

limerat

Wallets

1PPgmaXrzTj4ZXMTWNLh6VcmKRgU817rdK

Attributes
  • aes_key

    nyancat

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/FvCAV8it

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    Temp

  • pin_spread

    true

  • sub_folder

    \

  • usb_spread

    true

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a86db3b2d144844a959cf43dbe8ff4dc80b9ce0513e5bd7dd9fdf9325a4f2ac.exe
    "C:\Users\Admin\AppData\Local\Temp\8a86db3b2d144844a959cf43dbe8ff4dc80b9ce0513e5bd7dd9fdf9325a4f2ac.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:532
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\opener.bat" "
      2⤵
        PID:1932
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\avdisable.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\avdisable.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:952
    • C:\Windows\system32\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
      1⤵
        PID:1616
      • C:\Windows\system32\reg.exe
        reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
        1⤵
          PID:2028
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PayPal-Restore.exe
          PayPal-Restore.exe -dC:\Users\Admin\AppData\Local\Temp
          1⤵
            PID:588
            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\PayPal-Restore.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\PayPal-Restore.exe"
              2⤵
                PID:904
            • C:\Windows\system32\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
              1⤵
                PID:1000
              • C:\Windows\system32\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                1⤵
                  PID:1960
                • C:\Windows\system32\reg.exe
                  reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                  1⤵
                    PID:432
                  • C:\Windows\system32\reg.exe
                    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                    1⤵
                      PID:1596
                    • C:\Windows\system32\reg.exe
                      reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                      1⤵
                        PID:1508
                      • C:\Windows\system32\reg.exe
                        reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                        1⤵
                          PID:1468
                        • C:\Windows\system32\reg.exe
                          reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                          1⤵
                            PID:1812
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                            1⤵
                              PID:1772
                            • C:\Windows\system32\schtasks.exe
                              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                              1⤵
                                PID:1992
                              • C:\Windows\system32\schtasks.exe
                                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                1⤵
                                  PID:1964
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                  1⤵
                                    PID:452
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                    1⤵
                                      PID:688
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                      1⤵
                                        PID:1684
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                        1⤵
                                          PID:944
                                        • C:\Windows\system32\reg.exe
                                          reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                          1⤵
                                            PID:1732
                                          • C:\Windows\system32\reg.exe
                                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
                                            1⤵
                                              PID:1736
                                            • C:\Windows\system32\reg.exe
                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                              1⤵
                                                PID:1156
                                              • C:\Windows\system32\reg.exe
                                                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                1⤵
                                                  PID:1196
                                                • C:\Windows\system32\reg.exe
                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                  1⤵
                                                    PID:1740
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                    1⤵
                                                      PID:1628
                                                    • C:\Windows\system32\reg.exe
                                                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                      1⤵
                                                        PID:676
                                                      • C:\Windows\system32\reg.exe
                                                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                        1⤵
                                                          PID:564
                                                        • C:\Windows\system32\reg.exe
                                                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                          1⤵
                                                            PID:2044
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                            1⤵
                                                              PID:1008
                                                            • C:\Windows\system32\reg.exe
                                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                              1⤵
                                                                PID:2036
                                                              • C:\Windows\system32\reg.exe
                                                                reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                                1⤵
                                                                  PID:2020
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                                                  1⤵
                                                                    PID:1272
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                                                    1⤵
                                                                      PID:1792
                                                                    • C:\Windows\system32\cmd.exe
                                                                      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\234A.tmp\234B.tmp\234C.bat C:\Users\Admin\AppData\Local\Temp\RarSFX0\avdisable.exe"
                                                                      1⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1408

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v6

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Users\Admin\AppData\Local\Temp\234A.tmp\234B.tmp\234C.bat

                                                                      Filesize

                                                                      3KB

                                                                      MD5

                                                                      8760b15c6d12ecc70594fc8db876c68c

                                                                      SHA1

                                                                      b1d47a27bf45db9955f07c773a5a334e3b528a97

                                                                      SHA256

                                                                      9a3d9f84626d1443b0e1fc1afe22cc4045c20714b98838e94542991039cf8463

                                                                      SHA512

                                                                      0463204ebabf6465ba3be44b31dc235ba240f1899b41336655a3f361932b8225326d8ab7c53130d4ded9412193d5967f805221212b964d6a54492d0f2c331dee

                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PayPal-Restore.exe

                                                                      Filesize

                                                                      362KB

                                                                      MD5

                                                                      9f150fdb9779485a9b4af5875a48aaf7

                                                                      SHA1

                                                                      47e2d38e7c69a8e7f0e2993f3f8cb131483aa97f

                                                                      SHA256

                                                                      981c27f97402dab365ed009cff2ab23946424a8f0b1d31f080c1e8675434434a

                                                                      SHA512

                                                                      b4e94b127f75afb8fcc3d9555ecc608141b27e81755d3b9ffe0ef8632a7594806564f3e5a6dbbc2869b77c11d4570afc7b167440bcdf6f49934f2b4dbb4357df

                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PayPal-Restore.exe

                                                                      Filesize

                                                                      362KB

                                                                      MD5

                                                                      9f150fdb9779485a9b4af5875a48aaf7

                                                                      SHA1

                                                                      47e2d38e7c69a8e7f0e2993f3f8cb131483aa97f

                                                                      SHA256

                                                                      981c27f97402dab365ed009cff2ab23946424a8f0b1d31f080c1e8675434434a

                                                                      SHA512

                                                                      b4e94b127f75afb8fcc3d9555ecc608141b27e81755d3b9ffe0ef8632a7594806564f3e5a6dbbc2869b77c11d4570afc7b167440bcdf6f49934f2b4dbb4357df

                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\avdisable.exe

                                                                      Filesize

                                                                      56KB

                                                                      MD5

                                                                      b644afe28f2368af7da90246d13bce4a

                                                                      SHA1

                                                                      cd24a837643a47a240c7402592f47ba2e4a978b0

                                                                      SHA256

                                                                      e522c2e61f111716eb1b89ab6daf113c9537464f3dafc89a111e60bf6f1d84e5

                                                                      SHA512

                                                                      1dd0e33a4bceb3811565fc503e5d12c9bfa0f6687b94ad3232af1cd4bd092ea4759b0d82b3728f1ef203cd902ec1d5ac34fda25b167e001270524280f6a96d90

                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\opener.bat

                                                                      Filesize

                                                                      27B

                                                                      MD5

                                                                      76b34b8a915e15e32871820b24a60556

                                                                      SHA1

                                                                      aabf1487a5dc1880d5c8a6979666b215dc09a837

                                                                      SHA256

                                                                      ff8a34a62c2f4b7b5c058f67cfbbe5df9e74541f909a3b7f8c9fc8155b72d7a1

                                                                      SHA512

                                                                      2c0d801537d7576ab03b1eda1b0c60eb41525b4bd57b1a77a383b83dd49d20327b16162c7721c0e7b635734f6d96ffa4290dafc6350917ffa7114780d1716ffb

                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX1\PayPal-Restore.exe

                                                                      Filesize

                                                                      82KB

                                                                      MD5

                                                                      54a1574cacf95b6c5c9c597d8d76de45

                                                                      SHA1

                                                                      4879d75f50d747a400c03ab9700e816ec0607fe6

                                                                      SHA256

                                                                      67f6ae56cdde6082b3cf05ba9a1a730dcf2e63eeb291507f1420b818d6e05eb1

                                                                      SHA512

                                                                      869b1ae4b939c4a2ea6528c9639de811bbd6048c686c4a2a0ae63443510b7575fa816890a13e83504afb5ce0322de228c1c6db3ab9c437a35a6fb8eabd5aeb2f

                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX1\PayPal-Restore.exe

                                                                      Filesize

                                                                      82KB

                                                                      MD5

                                                                      54a1574cacf95b6c5c9c597d8d76de45

                                                                      SHA1

                                                                      4879d75f50d747a400c03ab9700e816ec0607fe6

                                                                      SHA256

                                                                      67f6ae56cdde6082b3cf05ba9a1a730dcf2e63eeb291507f1420b818d6e05eb1

                                                                      SHA512

                                                                      869b1ae4b939c4a2ea6528c9639de811bbd6048c686c4a2a0ae63443510b7575fa816890a13e83504afb5ce0322de228c1c6db3ab9c437a35a6fb8eabd5aeb2f

                                                                    • \Users\Admin\AppData\Local\Temp\RarSFX0\PayPal-Restore.exe

                                                                      Filesize

                                                                      362KB

                                                                      MD5

                                                                      9f150fdb9779485a9b4af5875a48aaf7

                                                                      SHA1

                                                                      47e2d38e7c69a8e7f0e2993f3f8cb131483aa97f

                                                                      SHA256

                                                                      981c27f97402dab365ed009cff2ab23946424a8f0b1d31f080c1e8675434434a

                                                                      SHA512

                                                                      b4e94b127f75afb8fcc3d9555ecc608141b27e81755d3b9ffe0ef8632a7594806564f3e5a6dbbc2869b77c11d4570afc7b167440bcdf6f49934f2b4dbb4357df

                                                                    • \Users\Admin\AppData\Local\Temp\RarSFX0\avdisable.exe

                                                                      Filesize

                                                                      63KB

                                                                      MD5

                                                                      31120f8f17f419583be650465cde8f50

                                                                      SHA1

                                                                      fe3ea43bb6b214d4e8e32f879811f6a7016d57e5

                                                                      SHA256

                                                                      a7b1756b3578853214a128219c0c005959b39c7105e5eb09b4484caeb877cd61

                                                                      SHA512

                                                                      6b80e28890aaeb963abe721eb020ab5ea336974a6be563cb9ada5648a4db074895a42f27591429e99a57e402a587699938724a20ef60c232e6bb8475f4bfee80

                                                                    • \Users\Admin\AppData\Local\Temp\RarSFX0\avdisable.exe

                                                                      Filesize

                                                                      43KB

                                                                      MD5

                                                                      fe4788726b2255e2aa33654f90e7f731

                                                                      SHA1

                                                                      da0181a736a57f57022d241e58fc6f4c25cec755

                                                                      SHA256

                                                                      9b0889135e08318e0f310913bac7ef86ed1af884ec460c11a66c7190195961a9

                                                                      SHA512

                                                                      550c50506d5adcfdf22d9c4252e8ad35ccd6eadb02a18185dd2fb7edab57a5e49c99d87ce5c7b9127d94131a71d513481cf0badd36630ed2c3e3ae6743429f33

                                                                    • \Users\Admin\AppData\Local\Temp\RarSFX0\avdisable.exe

                                                                      Filesize

                                                                      81KB

                                                                      MD5

                                                                      2b9eee13a0e979e7cce3cbd274386be9

                                                                      SHA1

                                                                      f7ac238066df9d83add932190055185a59d015d2

                                                                      SHA256

                                                                      2b552c6f59b52970e7c86ebe757293d57af3a1f5260b52744773edb5772e0576

                                                                      SHA512

                                                                      038caa0f92a17f8e9b3c56cc8afcde172703f28e0f0eb76a81cacc89290055f0343b1d6d1cb777e4673550bd4f5cc8ca9a8e4bc8bd32c9bb10d47bb2767cc0ed

                                                                    • \Users\Admin\AppData\Local\Temp\RarSFX1\PayPal-Restore.exe

                                                                      Filesize

                                                                      82KB

                                                                      MD5

                                                                      54a1574cacf95b6c5c9c597d8d76de45

                                                                      SHA1

                                                                      4879d75f50d747a400c03ab9700e816ec0607fe6

                                                                      SHA256

                                                                      67f6ae56cdde6082b3cf05ba9a1a730dcf2e63eeb291507f1420b818d6e05eb1

                                                                      SHA512

                                                                      869b1ae4b939c4a2ea6528c9639de811bbd6048c686c4a2a0ae63443510b7575fa816890a13e83504afb5ce0322de228c1c6db3ab9c437a35a6fb8eabd5aeb2f

                                                                    • \Users\Admin\AppData\Local\Temp\RarSFX1\PayPal-Restore.exe

                                                                      Filesize

                                                                      82KB

                                                                      MD5

                                                                      54a1574cacf95b6c5c9c597d8d76de45

                                                                      SHA1

                                                                      4879d75f50d747a400c03ab9700e816ec0607fe6

                                                                      SHA256

                                                                      67f6ae56cdde6082b3cf05ba9a1a730dcf2e63eeb291507f1420b818d6e05eb1

                                                                      SHA512

                                                                      869b1ae4b939c4a2ea6528c9639de811bbd6048c686c4a2a0ae63443510b7575fa816890a13e83504afb5ce0322de228c1c6db3ab9c437a35a6fb8eabd5aeb2f

                                                                    • \Users\Admin\AppData\Local\Temp\RarSFX1\PayPal-Restore.exe

                                                                      Filesize

                                                                      82KB

                                                                      MD5

                                                                      54a1574cacf95b6c5c9c597d8d76de45

                                                                      SHA1

                                                                      4879d75f50d747a400c03ab9700e816ec0607fe6

                                                                      SHA256

                                                                      67f6ae56cdde6082b3cf05ba9a1a730dcf2e63eeb291507f1420b818d6e05eb1

                                                                      SHA512

                                                                      869b1ae4b939c4a2ea6528c9639de811bbd6048c686c4a2a0ae63443510b7575fa816890a13e83504afb5ce0322de228c1c6db3ab9c437a35a6fb8eabd5aeb2f

                                                                    • \Users\Admin\AppData\Local\Temp\RarSFX1\PayPal-Restore.exe

                                                                      Filesize

                                                                      82KB

                                                                      MD5

                                                                      54a1574cacf95b6c5c9c597d8d76de45

                                                                      SHA1

                                                                      4879d75f50d747a400c03ab9700e816ec0607fe6

                                                                      SHA256

                                                                      67f6ae56cdde6082b3cf05ba9a1a730dcf2e63eeb291507f1420b818d6e05eb1

                                                                      SHA512

                                                                      869b1ae4b939c4a2ea6528c9639de811bbd6048c686c4a2a0ae63443510b7575fa816890a13e83504afb5ce0322de228c1c6db3ab9c437a35a6fb8eabd5aeb2f

                                                                    • memory/432-88-0x0000000000000000-mapping.dmp

                                                                    • memory/452-80-0x0000000000000000-mapping.dmp

                                                                    • memory/532-54-0x0000000075711000-0x0000000075713000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/564-69-0x0000000000000000-mapping.dmp

                                                                    • memory/588-97-0x0000000000000000-mapping.dmp

                                                                    • memory/676-70-0x0000000000000000-mapping.dmp

                                                                    • memory/688-79-0x0000000000000000-mapping.dmp

                                                                    • memory/904-107-0x0000000000940000-0x000000000095A000-memory.dmp

                                                                      Filesize

                                                                      104KB

                                                                    • memory/904-104-0x0000000000000000-mapping.dmp

                                                                    • memory/944-77-0x0000000000000000-mapping.dmp

                                                                    • memory/952-58-0x0000000000000000-mapping.dmp

                                                                    • memory/1000-90-0x0000000000000000-mapping.dmp

                                                                    • memory/1008-67-0x0000000000000000-mapping.dmp

                                                                    • memory/1156-74-0x0000000000000000-mapping.dmp

                                                                    • memory/1196-73-0x0000000000000000-mapping.dmp

                                                                    • memory/1272-64-0x0000000000000000-mapping.dmp

                                                                    • memory/1408-61-0x0000000000000000-mapping.dmp

                                                                    • memory/1468-85-0x0000000000000000-mapping.dmp

                                                                    • memory/1508-86-0x0000000000000000-mapping.dmp

                                                                    • memory/1596-87-0x0000000000000000-mapping.dmp

                                                                    • memory/1616-92-0x0000000000000000-mapping.dmp

                                                                    • memory/1628-71-0x0000000000000000-mapping.dmp

                                                                    • memory/1684-78-0x0000000000000000-mapping.dmp

                                                                    • memory/1732-76-0x0000000000000000-mapping.dmp

                                                                    • memory/1736-75-0x0000000000000000-mapping.dmp

                                                                    • memory/1740-72-0x0000000000000000-mapping.dmp

                                                                    • memory/1772-83-0x0000000000000000-mapping.dmp

                                                                    • memory/1792-63-0x0000000000000000-mapping.dmp

                                                                    • memory/1812-84-0x0000000000000000-mapping.dmp

                                                                    • memory/1932-93-0x0000000000000000-mapping.dmp

                                                                    • memory/1960-89-0x0000000000000000-mapping.dmp

                                                                    • memory/1964-81-0x0000000000000000-mapping.dmp

                                                                    • memory/1992-82-0x0000000000000000-mapping.dmp

                                                                    • memory/2020-65-0x0000000000000000-mapping.dmp

                                                                    • memory/2028-91-0x0000000000000000-mapping.dmp

                                                                    • memory/2036-66-0x0000000000000000-mapping.dmp

                                                                    • memory/2044-68-0x0000000000000000-mapping.dmp